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REMARKS 

The Office Action dated December 26, 2007, has been 
received and carefully considered. Reconsideration of the 
current rejections in the present application is respectfully 
requested based on the following remarks. 

I . THE NON- STATUTORY SUBJECT MATTER REJECTION OF CLAIM 11 

On page 2 of the Office Action, claim 11 was rejected under 
35 U.S.C. § 101 as being directed to non-statutory subject 
matter. This rejection is hereby respectfully traversed. 

The Examiner asserts that claim 11 is non- statutory 
because, on page 19, lines 7-9, of the specification, Applicant 
describes that the medium that carries the instructions can be a 
form of signal. Moreover, the Examiner requires that the 
recitation "or transmitted to one or more processors via one or 
more signals" be deleted from the specification. Applicant 
respectfully disagree. Applicant respectfully submits that the 
specification recites "one or more processors operating in 
accordance with stored instructions may implement the functions 
associated with source address tracing in accordance with the 
present invention as described above. If such is the case , it 
is within the scope of the present invention that such 
instructions may be stored on one or more processor readable 
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carriers (e.g., a magnetic disk), or transmitted to one or more 

processors via one or more signals ." See, page 19, lines 2-9. 

Therefore, Applicant respectfully submits that the instructions 

are stored (e.g., on a magnetic disk) and may be either readable 

by one or more processors or transmitted to one or more 

processors via one or more signals. Furthermore, Applicant 

respectfully submits that claim 11 does not recite "the medium 

that carries the instructions can be a form of signal," as 

asserted by the Examiner. For example, claim 11 recites " [a] t 

least one processor readable medium for storing a computer 

program of instructions configured to be readable by at least 

one processor for instructing the at least one processor to 

execute a computer process for performing the method as recited 

in claim 1." This contradicts the Examiner's assertion that the 

claim 11 does not recite a computer program being stored and 

executable on any readable medium. Thus, claim 11 clearly 

recites such a tangible embodiment. 

In view of the foregoing, it is respectfully requested that 

the aforementioned non-statutory subject matter rejection of 

claim 11 be withdrawn. 

II . THE ANTICIPATION REJECTION OF CLAIMS 1-5, 9, 12-16, 20 & 21 
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On pages 3-4 of the Office Action, claims 1-5, 9, 12-16, 
20, and 21 were rejected under 35 U.S.C. § 102(a) as being 
anticipated by Peng et al . ("Detecting Distributed Denial of 
Service Attacks Using Source IP Address Monitoring"). This 
rejection is hereby respectfully traversed. 

Under 35 U.S.C. § 102, the Patent Office bears the burden 
of presenting at least a prima facie case of anticipation. In re 
Sun, 31 USPQ2d 1451, 1453 (Fed. Cir. 1993) (unpublished). 
Anticipation requires that a prior art reference disclose, 
either expressly or under the principles of inherency, each and 
every element of the claimed invention. Id. . "In addition, the 
prior art reference must be enabling." Akzo N.V. v. U.S. 
International Trade Commission , 808 F.2d 1471, 1479, 1 USPQ2d 
1241, 1245 (Fed. Cir. 1986), cert, denied , 482 U.S. 909 (1987). 
That is, the prior art reference must sufficiently describe the 
claimed invention so as to have placed the public in possession 
of it. In re Donohue , 766 F.2d 531, 533, 226 USPQ 619, 621 (Fed. 
Cir. 1985) . Such possession is effected only if one of ordinary 
skill in the art could have combined the disclosure in the prior 
art reference with his/her own knowledge to make the claimed 
invention. Id. . 

Regarding claims 1, 12, and 21, the Examiner asserts that 
Peng et al . discloses the claimed invention. Specifically, the 
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Examiner asserts that because Peng et al . teaches matching the 

IP source address of the incoming packets to the source and 

therefore discloses "determining whether the at least part of 

the source address matches at least one source address recorded 

within a predetermined time period prior to arrival of the 

packet," as presently claimed. Applicant respectfully 

disagrees. Specifically, Applicant respectfully submits that 

Peng et al . does not match the IP source address of the incoming 

packets to the source addresses recorded in a hash table. 

Instead, Peng et al . merely discloses "comparing the current 

counts of the hash table with the IAD" to "calculate how many 

new IP addresses have appeared in this time slot." See, page 4, 

Section A. Moreover, Peng et al . fails to disclose, or even 

suggest, that the IAD contains IP addresses that include "at 

least one source address recorded within a predetermined time 

period prior to the arrival of the packet," as presently 

claimed. 

Also, Applicant respectfully submits that Peng et al . and 
the other cited references, taken either alone or in 
combination, fail to disclose, or even suggest, routing a packet 
if at least part of a source address matches at least one source 
address recorded within a predetermined time period prior to 
arrival of the packet , as presently claimed. In contrast, Peng 
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et al. discloses adding legitimate IP addresses to an IP Address 

Database (IAD) , recording IP addresses that appear in a current 

time interval in a hash table along with a number of IP packets 

and a time stamp of the most recent IP packet for each IP 

address, and comparing the IAD to the hash table to determine 

the number of new IP addresses that have appeared in the current 

time interval. For unsophisticated attacks, Peng et al . also 

discloses detecting an attack (and preventing packet routing) if 

the number of IP packets per IP address is larger than a certain 

threshold. For more sophisticated attacks, Peng et al . further 

discloses detecting an attack (and preventing packet routing) if 

the number of new IP addresses that have appeared in the current 

time interval changes abruptly. (See Peng et al., page 4, 

Section A and Fig. 3). These disclosures by Peng et al . fail to 

disclose, or even suggest, "routing the packet if at least part 

of a source address matches at least one source address recorded 

within a predetermined time period prior to arrival of the 

packet," as presently claimed. 

Furthermore, the Examiner asserts that Peng et al . 

discloses recording the arrival time of the packet in the hash 

table if an address matches one recorded in the hash table. The 

Examiner goes on to assert that such a disclosure by Peng et al . 

discloses "routing a packet if at least part of a source address 
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matches at least one source address recorded within a 

predetermined time period prior to arrival of the packet," as 

presently claimed. Applicant respectfully disagrees and 

respectfully submits that recording of an arrival time 

associated with an IP address in a hash table does not disclose, 

or even suggest, " routing a packet if at least part of a source 

address matches at least one source address recorded within a 

predetermined time period prior to arrival of the packet," as 

presently claimed. 

In view of the foregoing, is it respectfully submitted that 
claims 1, 12, and 21 are allowable over Peng et al . 

At this point, Applicant would like to remind the Examiner 
that, as stated in MPEP § 2131, "[a] claim is anticipated only 
if each and every element as set forth in the claim is found, 
either expressly or inherently described, in a single prior art 
reference." Verdegaal Bros, v. Union Oil Co. of California , 2 
USPQ2d 1051, 1053 (Fed. Cir. 1987) . 

Regarding claims 2-5, 9, 13-16, and 20, these claims are 
dependent upon independent claims 1 and 12. Thus, since 
independent claims 1 and 12 should be allowable as discussed 
above, claims 2-5, 9, 13-16, and 2 0 should also be allowable at 
least by virtue of their dependency on independent claims 1 and 
12. Moreover, these claims recite additional features which are 
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not disclosed, or even suggested, by the cited references taken 

either alone or in combination. 

In view of the foregoing, it is respectfully requested that 

the aforementioned anticipation rejection of claims 1-5, 9, 12- 

16, 20, and 21 be withdrawn. 

III. THE OBVIOUSNESS REJECTION OF CLAIMS 6 AND 17 

On page 5 of the Office Action, claims 6 and 17 were 
rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Peng et al . ("Detecting Distributed Denial of Service Attacks 
Using Source IP Address Monitoring"). This rejection is hereby 
respectfully traversed. 

As stated in MPEP § 2143.03, to establish prima facie 
obviousness of a claimed invention, all the claim limitations 
must be taught or suggested by the prior art. In re Royka , 490 
F.2d 981, 180 USPQ 580 (CCPA 1974). That is, " [a] 11 words in a 
claim must be considered in judging the patentability of that 
claim against the prior art." In re Wilson , 424 F.2d 1382, 165 
USPQ 494, 496 (CCPA 1970). If an independent claim is 

nonobvious under 35 U.S.C. 103, then any claim depending 
therefrom is nonobvious. In re Fine , 83 7 F.2d 1071, 5 USPQ2d 
1596 (Fed. Cir. 1988) . 
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Regarding claims 6 and 17, these claims are dependent upon 
independent claims 1 and 12. Thus, since independent claims 1 
and 12 should be allowable as discussed above, claims 6 and 17 
should also be allowable at least by virtue of their dependency 
on independent claims 1 and 12. Moreover, these claims recite 
additional features which are not disclosed, or even suggested, 
by the cited references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 
the aforementioned obviousness rejection of claims 6 and 17 be 
withdrawn. 

IV. THE OBVIOUSNESS REJECTION OF CLAIMS 7, 8, 18, AND 19 

On page 5 of the Office Action, claims 7, 8, 18, and 19 
were rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Peng et al . ("Detecting Distributed Denial of Service 
Attacks Using Source IP Address Monitoring") in view of 
Lingafelt et al . (U.S. Patent Application Publication No. 
US2002/0147925A1) . This rejection is hereby respectfully 

traversed. 

It is respectfully submitted that the aforementioned 
obviousness rejection of claims 7, 8, 18, and 19 has become moot 
in view of the deficiencies of the primary reference (i.e., Peng 
et al . ) as discussed above with respect to independent claims 1 
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and 12. That is, claims 7, 8, 18, and 19 are dependent upon 

independent claims 1 and 12 and thus inherently incorporate all 

of the limitations of independent claims 1 and 12. Also, the 

secondary reference (i.e., Lingafelt et al . ) fails to disclose, 

or even suggest, the deficiencies of the primary reference as 

discussed above with respect to independent claims 1 and 12. 

Indeed, the Examiner does not even assert such. Thus, the 

combination of the secondary reference with the primary 

reference also fails to disclose, or even suggest, the 

deficiencies of the primary reference as discussed above with 

respect to independent claims 1 and 12. Accordingly, claims 7, 

8, 18, and 19 should be allowable over the combination of the 

secondary reference with the primary reference at least by 

virtue of their dependency on independent claims 1 and 12. 

Moreover, claims 7, 8, 18, and 19 recite additional features 

which are not disclosed, or even suggested, by the cited 

references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 

the aforementioned obviousness rejection of claims 7, 8, 18, and 

19 be withdrawn. 

V. THE OBVIOUSNESS REJECTION OF CLAIM 11 
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On page 6 of the Office Action, claims 11 were rejected 

under 35 U.S. C. § 103(a) as being unpatentable over Peng et al . 

("Detecting Distributed Denial of Service Attacks Using Source 

IP Address Monitoring") in view of Langberg et al . (U.S. Patent 

No. 5,852,630). This rejection is hereby respectfully 

traversed. 

It is respectfully submitted that the aforementioned 
obviousness rejection of claim 11 has become moot in view of the 
deficiencies of the primary reference (i.e., Peng et al . ) as 
discussed above with respect to independent claim 1. That is, 
claim 11 is dependent upon independent claim 1 and thus 
inherently incorporates all of the limitations of independent 
claim 1. Also, the secondary reference (i.e., Langberg et al . ) 
fails to disclose, or even suggest, the deficiencies of the 
primary reference as discussed above with respect to independent 
claim 1. Indeed, the Examiner does not even assert such. Thus, 
the combination of the secondary reference with the primary 
reference also fails to disclose, or even suggest, the 
deficiencies of the primary reference as discussed above with 
respect to independent claim 1. Accordingly, claim 11 should be 
allowable over the combination of the secondary reference with 
the primary reference at least by virtue of its dependency on 
independent claim 1. Moreover, claim 11 recites additional 
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features which are not disclosed, or even suggested, by the 

cited references taken either alone or in combination. 

In view of the foregoing, it is respectfully requested that 

the aforementioned obviousness rejection of claim 11 be 

withdrawn. 

VI . CONCLUSION 

In view of the foregoing, it is respectfully submitted that 
the present application is in condition for allowance, and an 
early indication of the same is courteously solicited. The 
Examiner is respectfully requested to contact the undersigned by 
telephone at the below listed telephone number, in order to 
expedite resolution of any issues and to expedite passage of the 
present application to issue, if any comments, questions, or 
suggestions arise in connection with the present application. 

To the extent necessary, a petition for an extension of 
time under 3 7 CFR § 1.136 is hereby made. 

Please charge any shortage in fees due in connection with 
the filing of this paper, including extension of time fees, to 
Deposit Account No. 50-0206, and please credit any excess fees 
to the same deposit account. 

Respectfully submitted, 
Hunton & Williams LLP 
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